4.2 Configuring Logging, Monitoring, and Detection PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to determine whether any traffic was blocked by the firewall and also see the source and destination IPs of the blocked traffic. Which log source should the analyst query?

   • ACloud IDS
   • BPacket Mirroring
   • CCloud NGFW logs
   • DVPC flow logs
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company must retain audit logs for 7 years to meet regulatory requirements, but the security team is concerned about the cost of storing all logs in Cloud Logging's default retention. They also need to ensure that only authorized security personnel can access the archived logs. Which strategy should they implement?

   • AUse Cloud IDS to store the logs
   • BConfigure a log sink to export audit logs to a Cloud Storage bucket with a 7-year retention policy, and restrict access to the bucket using IAM
   • CStore logs in BigQuery and rely on BigQuery's default table expiration
   • DIncrease the Cloud Logging retention period to 7 years for all logs
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When designing a logging strategy, which factor should be considered to balance log coverage with cost?

   • AUse the same retention period for all logs to simplify management
   • BSelect log types and retention based on risk, compliance, and cost
   • CEnable all possible logs for every resource regardless of cost
   • DOnly enable logging for the most critical resources
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team needs to allow a third-party SIEM to ingest audit logs from a project, but the team is concerned about the SIEM's service account having too broad access to the project's logging infrastructure. They also want to ensure that the SIEM can only read logs, not modify or delete them. Which IAM configuration should they use?

   • AGrant the SIEM service account the roles/logging.configWriter role on the project
   • BGrant the SIEM service account the roles/logging.admin role on the project
   • CGrant the SIEM service account the roles/logging.viewer role on the project
   • DCreate a log sink that exports logs to a Pub/Sub topic and grant the SIEM service account the roles/pubsub.subscriber role on that topic
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security team needs to export logs from all projects in an organization to a central SIEM. Which type of log sink should they configure?

   • AA project-level sink
   • BA folder-level sink
   • CAn aggregated sink
   • DA billing-level sink
   Reveal Solution Discussion Select an answer first